diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index be432c25..89c07d8f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,10 +2,11 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-# CI for the Docker-executor runner (VM). The lint/test jobs run inside the
-# shared trx-rs SDK image (container/Containerfile), which bakes in the pinned
-# Rust toolchain and all build dependencies. The reuse job uses the upstream
-# Docker action, which the Docker executor launches as a sibling container.
+# CI for the Docker-executor runner (VM). The lint, test and frontend jobs run
+# inside the shared trx-rs SDK image (container/Containerfile), which bakes in
+# the pinned Rust toolchain, Node.js, Chromium and all build dependencies. The
+# reuse job uses the upstream Docker action, which the Docker executor launches
+# as a sibling container.
 
 name: CI
 
@@ -53,6 +54,7 @@ jobs:
 
   frontend:
     runs-on: ubuntu-latest
+    container: git.haxx.space/sjg/trx-rs/sdk:latest
     defaults:
       run:
         working-directory: src/trx-client/trx-frontend/trx-frontend-http/frontend
@@ -73,15 +75,12 @@ jobs:
         run: npm run lint
       - name: Test
         run: npm test
-      - name: Install browser smoke dependency
-        run: command -v chromium >/dev/null || (sudo apt-get update && sudo apt-get install -y --no-install-recommends chromium)
+      # Chromium comes from the SDK image at the path the smoke test defaults
+      # to, so there is nothing to install here.
       - name: Browser smoke test
         run: npm run test:browser
       - name: Verify generated assets
         run: npm run verify-generated
-      - name: Verify generated-file licensing
-        working-directory: .
-        run: reuse lint
 
   reuse:
     runs-on: ubuntu-latest
diff --git a/container/README.md b/container/README.md
index dac690f9..76c8cf91 100644
--- a/container/README.md
+++ b/container/README.md
@@ -48,11 +48,17 @@ Building outside the container? `rust-toolchain.toml` pins the same rustc, so
 
 ## CI use
 
-`.gitea/workflows/ci.yml` runs the `lint` and `test` jobs *inside* this image
-via the `container:` key, so they skip all setup and go straight to `cargo`.
+`.gitea/workflows/ci.yml` runs the `lint`, `test` and `frontend` jobs *inside*
+this image via the `container:` key, so they skip all setup and go straight to
+`cargo` and `npm`. The frontend job needs three things from the image beyond
+Rust: Node.js for the toolchain, Chromium at `/usr/bin/chromium` for the
+browser smoke test, and `cargo` — `npm run verify-generated` regenerates the
+Rust wire contracts before checking for drift.
+
 The `reuse` job stays on the upstream `fsfe/reuse-action` (a Docker action the
 Docker executor launches as a sibling container) — nothing REUSE-related is
-baked into the SDK.
+baked into the SDK, and it lints the whole repository, so no job runs its own
+licence check.
 
 ## Compilation cache (sccache)